]> git.ipfire.org Git - thirdparty/suricata-verify.git/commitdiff
check-eve: test for duplicate json keys
authorJason Ish <jason.ish@oisf.net>
Wed, 3 Jan 2024 20:33:26 +0000 (14:33 -0600)
committerVictor Julien <victor@inliniac.net>
Mon, 22 Jan 2024 19:58:08 +0000 (20:58 +0100)
Add a duplicate key check to check-eve. If a duplicate key is found
in a JSON record, the test will fail with a schema error.

check-eve.py

index a21b7060d4d19344b87a05fc002e03b6570024d2..1aaadccdfa147c827fcd9069aa14d97c3ff54601 100755 (executable)
@@ -36,6 +36,28 @@ try:
 except:
     HAVE_PY = False
 
+
+class DuplicateKeyError(Exception):
+    pass
+
+
+def duplicate_key_object_pair_hook(pairs):
+    d = {}
+    for k, v in pairs:
+        if k in d:
+            raise DuplicateKeyError(
+                "key={}, current value={}, new value={}".format(k, d[k], v)
+            )
+        d[k] = v
+    return d
+
+
+def check_duplicate_keys(filename):
+    with open(filename) as json_in:
+        for line in json_in:
+            json.loads(line, object_pairs_hook=duplicate_key_object_pair_hook)
+
+
 def validate_json(args, json_filename, schema):
     status = "OK"
     errors = []
@@ -56,6 +78,14 @@ def validate_json(args, json_filename, schema):
                     status = "FAIL"
                     errors.append(err.message)
 
+    # Look for duplicate keys.
+    try:
+        check_duplicate_keys(json_filename)
+    except DuplicateKeyError as err:
+        print("{}: duplicate key error: {}".format(json_filename, err))
+        status = "FAIL"
+        errors.append(err)
+
     if not args.quiet:
         if status == "FAIL":
             print("===> %s: FAIL " % json_filename)